From Few-Shot to Zero-Shot: Towards Generalist Graph Anomaly Detection

Abstract

Graph anomaly detection (GAD) is critical for identifying abnormal nodes in graph-structured data from diverse domains, including cybersecurity and social networks. The existing GAD methods often focus on the learning paradigms of “one-model-for-one-dataset”, requiring dataset-specific training for each dataset to achieve optimal performance. However, this paradigm suffers from limitations, such as high computational and data costs, limited generalization and transferability to new datasets, and challenges in privacy-sensitive scenarios where access to full datasets or sufficient labels is restricted. To address these limitations, we propose a novel generalist GAD paradigm that aims to develop a unified model capable of detecting anomalies on multiple unseen datasets without retraining/fine-tuning or customization. To this end, we propose a few-shot generalist GAD method with three key designs, namely feature Alignment, a Residual encoder, and in-Context learning, abbreviated as ARC. As a generalist approach, ARC only requires a few labeled normal samples during prediction on any unseen graphs. Specifically, ARC consists of three modules: a feature Alignment module to unify and align features across datasets, a Residual graph encoder to capture dataset-agnostic anomaly representations, and a cross-attentive in-Context learning module to score anomalies using few-shot normal context. Building on ARC, we further introduce ARC$_{\mathrm{zero}}$ for the zero-shot generalist GAD setting, which selects representative pseudo-normal nodes via a pseudo-context mechanism and thus enables fully label-free inference on unseen datasets. Experiments on 17 real-world datasets demonstrate that ARC and ARC$_{\mathrm{zero}}$ effectively detect anomalies, exhibit strong generalization ability, and perform efficiently under few-shot and zero-shot settings.